Skip to content

[pull] master from php:master - #1299

Merged
pull[bot] merged 16 commits into
turkdevops:masterfrom
php:master
Sep 23, 2026
Merged

pull[bot] merged 16 commits into
turkdevops:masterfrom
php:master

Conversation

@pull

@pull pull Bot commented Sep 23, 2026 •

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

Girgias and others added 16 commits September 23, 2026 15:22
Do not replace pending exceptions with return-value validation errors in
the user handler adapter, including exceptions raised while destroying
invalid return values. This preserves the original exception for
session_start(), session_create_id(), and session_regenerate_id().

Closes GH-23854
* PHP-8.4:
  ext/session: Preserve exceptions thrown by create_sid()
* PHP-8.5:
  ext/session: Preserve exceptions thrown by create_sid()
* PHP-8.6:
  ext/session: Preserve exceptions thrown by create_sid()
This function is unsafe, because it reused the `retval` for each execution,
without clearing it in-between each script, leading to memory leaks.

Instead of fixing it, we just remove it: Writing a loop yourself is not much
more complicated than using this variadic function and provides more
flexibility.
zend_object_alloc() zeroes the object, so cached_resize started at 0, which
spl_fixedarray_resize() reads as "resize in progress" and returns early.
setSize() therefore did nothing on subclasses whose constructor does not
call parent::__construct(). Initialise the struct on object creation.

setSize(0) clears the array before destroying its elements, so it looks
unconstructed to userland. __construct(), __wakeup() and __unserialize()
then re-initialised it, and the in-progress clear discarded the buffer
they had installed. cb3dc62 fixed the same leak for a re-entrant
setSize() by testing the resize sentinel first; apply that test to the
other three entry points.

Close GH-23812
* PHP-8.4:
  Fix GH-23811: SplFixedArray leak on re-init and broken setSize()
* PHP-8.5:
  Fix GH-23811: SplFixedArray leak on re-init and broken setSize()
* PHP-8.6:
  Fix GH-23811: SplFixedArray leak on re-init and broken setSize()
@pull pull Bot locked and limited conversation to collaborators Sep 23, 2026
@pull pull Bot added the ⤵️ pull label Sep 23, 2026
@pull
pull Bot merged commit 42c147a into turkdevops:master Sep 23, 2026
0 of 2 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants